Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04)

PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin
under field API_TOKEN (re-stored from initial Token field to match
CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid
against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true).

- catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13
- playbook: header active/resolvable, drop post-promotion caveat
- workplan: T04 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md

@@ -74,16 +74,20 @@ state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
 
 ```task
 id: WARDEN-WP-0025-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
 ```
 
-- [ ] Mint PAT as Forgejo user `tegwick` (attended)
-- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin`
-- [ ] Positive fetch after OIDC login
+- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12)
+- [x] Stored at `platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN`
+      (initial provision used field `Token`; re-stored as `API_TOKEN` 2026-07-13 to
+      match CCR/catalog/playbook `fetch_command`)
+- [x] Positive fetch verified 2026-07-13 — `bao kv get -field=API_TOKEN …` returns
+      non-empty; PAT valid against `forgejo.coulomb.social` (`/api/v1/user` →
+      `login=tegwick`, `is_admin=true`)
 - [x] Negative default-policy denial recorded on CCR
-- [ ] Promote catalog to `active` after positive verify
+- [x] Promoted catalog `forgejo-admin-api-token` to `active` (`resolvable: true`)
 
 ### T5 — Notify downstream consumers